d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14-03-2024 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe
Size

196KB
MD5

8c9f87a56213fd81590d2b75553ca612
SHA1

2b8e6e7f879dca0d8485d4868b7d0b419847b647
SHA256

d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f
SHA512

87431d3b322dbd55eddbbbacdd1774023865983d3800c8780886e4ba8f9bb19ada8ed7ec334cfeecfb3fed2812e950da73bc03f6f67f5338bda98b9e1eff824f
SSDEEP

1536:pvVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjrSrowlU5PT:pvVQLIkLWeaA8KlCph9GrowliT

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2916	jusched.exe

Loads dropped DLL 2 IoCs

pid	Process
2040	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe
2040	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\26723c97\jusched.exe	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe
File created	C:\Program Files (x86)\26723c97\26723c97	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Update23.job	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2916	2040	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe	28
PID 2040 wrote to memory of 2916	2040	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe	28
PID 2040 wrote to memory of 2916	2040	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe	28
PID 2040 wrote to memory of 2916	2040	d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe	28

C:\Users\Admin\AppData\Local\Temp\d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe
"C:\Users\Admin\AppData\Local\Temp\d38926ca512f16be28d3331852e0296128a97497e6d98de82890006f27b5000f.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\26723c97\jusched.exe
  "C:\Program Files (x86)\26723c97\jusched.exe"
  2⤵
  - Executes dropped EXE
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\26723c97\26723c97

Filesize
17B

MD5
7bdf61d37c9adf3e1c6937107016091f

SHA1
56b8e0c454f9dd16d508a04b3afa7e458453ac41

SHA256
4c57d86c256214baa0a5a3322ef5cdd575210455b7e964ad60382bd9d4be12e0

SHA512
ff4fc1a427c84f47042375749f45ee6edea73b902ae977f14243ebceb7b9a28f41fe5dd404e3ea381754d9122202bc6b61ed0152b20a1c1be76c225dd20861d1

Download Submit
C:\Program Files (x86)\26723c97\jusched.exe

Filesize
128KB

MD5
7721f07358e69443472a50bcf79c4f3c

SHA1
1cad174e2658e5a56aee6eee18961a8a0edac2a3

SHA256
dc2fa9e79bdfb8415cfef7031ed32eee7e2ea7757d49da9eefc4f8eb88babc7d

SHA512
5e5402e181f463a206dca5004ea54ad1a58742357925787c792e9f8661a3c1321673217a4d07db5775ecf9a3a9858d18e85e216b4ac110d2cefa465e2666b67a

Download Submit
C:\Program Files (x86)\26723c97\jusched.exe

Filesize
192KB

MD5
256936ed30a2c91e8bd86035c13dcf18

SHA1
e185ca070cd4a707f40ce690eda01a16fb9e24bc

SHA256
6cac0c554bb5d9b73af83d3af393273cf45810dd21d6b2a298300bf6accc4727

SHA512
38e65f74e8cbcc64d555422a9681a5310cecbc3bd95d4e5f2166661e1b0a16db6d035a10c231bbc158104043d8d24f0e11eec929b78638e85bff4018802e61fe

Download Submit
\Program Files (x86)\26723c97\jusched.exe

Filesize
196KB

MD5
b2992418cdc708db6ada6ecf12c436fa

SHA1
25daeab09c31e0489be2797ead7015fe790e6d25

SHA256
61154e3aa495ca98fb4ff2f07f5ef7d26174f6d2717aa0a1ef652b1638d392ba

SHA512
d7423854561bc3a27d1980712c7c8b55c94a172a1a93dd5f850169b556c790a1361beb5ae88dd1555fc81349bc117fcbba70307666b85b94834b48f05c5cce9d

Download Submit
memory/2040-0-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2040-12-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/2040-11-0x0000000002AE0000-0x0000000002BAA000-memory.dmp

Filesize
808KB

Download
memory/2916-14-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download